44 lines
1.3 KiB
Plaintext
44 lines
1.3 KiB
Plaintext
|
#DESC mdadm - Linux RAID tool
|
||
|
|
#
|
||
|
|
# Author: Colin Walters <walters@redhat.com>
|
||
|
|
#
|
||
|
|
|
||
|
|
daemon_base_domain(mdadm, `, fs_domain, privmail')
|
||
|
|
role sysadm_r types mdadm_t;
|
||
|
|
|
||
|
|
allow initrc_t mdadm_var_run_t:file create_file_perms;
|
||
|
|
|
||
|
|
# Kernel filesystem permissions
|
||
|
|
r_dir_file(mdadm_t, proc_t)
|
||
|
|
allow mdadm_t proc_mdstat_t:file rw_file_perms;
|
||
|
|
read_sysctl(mdadm_t)
|
||
|
|
r_dir_file(mdadm_t, sysfs_t)
|
||
|
|
|
||
|
|
# Configuration
|
||
|
|
allow mdadm_t { etc_t etc_runtime_t }:file { getattr read };
|
||
|
|
read_locale(mdadm_t)
|
||
|
|
|
||
|
|
# Linux capabilities
|
||
|
|
allow mdadm_t self:capability { dac_override sys_admin ipc_lock };
|
||
|
|
|
||
|
|
# Helper program access
|
||
|
|
can_exec(mdadm_t, { bin_t sbin_t })
|
||
|
|
|
||
|
|
# RAID block device access
|
||
|
|
allow mdadm_t fixed_disk_device_t:blk_file create_file_perms;
|
||
|
|
allow mdadm_t device_t:lnk_file { getattr read };
|
||
|
|
|
||
|
|
# Ignore attempts to read every device file
|
||
|
|
dontaudit mdadm_t device_type:{ chr_file blk_file } getattr;
|
||
|
|
dontaudit mdadm_t device_t:{ fifo_file file dir chr_file blk_file } { read getattr };
|
||
|
|
dontaudit mdadm_t devpts_t:dir r_dir_perms;
|
||
|
|
|
||
|
|
# Ignore attempts to read/write sysadmin tty
|
||
|
|
dontaudit mdadm_t sysadm_tty_device_t:chr_file rw_file_perms;
|
||
|
|
|
||
|
|
# Other random ignores
|
||
|
|
dontaudit mdadm_t tmpfs_t:dir r_dir_perms;
|
||
|
|
dontaudit mdadm_t initctl_t:fifo_file getattr;
|
||
|
|
var_run_domain(mdadm)
|
||
|
|
allow mdadm_t var_t:dir { getattr search };
|